Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signing in to websites with SSH

vtllf.org

Post reply on HN
Print view View original

101–110 of 169 posts

Re: Signing in to websites with SSH

#101

Post by hughes »

This question might be hilariously naive... but why don't web browsers make signed requests, just as web servers make signed responses?

If I create an account on a website, then associate a public key with my account, shouldn't the browser be able to sign each request with my key? The website then wouldn't ever even have to deal with cookies or sessions as long as I was logged in to my browser.

Or better yet, if my key is publicly known and trusted, couldn't a website know who I am before I even create an account? It could skip the signup process entirely.

Re: Signing in to websites with SSH

#102

Post by NathanKP »

hughes wrote: post #101

This question might be hilariously naive... but why don't web browsers make signed requests, just as web servers make signed responses? If I create an account on a website, then associate a public key with my account, shouldn't the browser be able to sign each request with my key? The website then wouldn't ever even have to deal with cookies or sessions as long as I was logged in to my browser. Or better yet, if my k…

I'm sure that tracking services and ad companies would love signed requests.

Re: Signing in to websites with SSH

#103

Post by hughes »

NathanKP wrote: post #102
hughes wrote: post #101

This question might be hilariously naive... but why don't web browsers make signed requests, just as web servers make signed responses? If I create an account on a website, then associate a public key with my account, shouldn't the browser be able to sign each request with my key? The website then wouldn't ever even have to deal with cookies or sessions as long as I was logged in to my browser. Or better yet, if my k…

I'm sure that tracking services and ad companies would love signed requests.

Well, it could maybe be an opt-in feature, like when a site requests to use your webcam or microphone. A small prompt that the server is requesting to access your identity or something.

Re: Signing in to websites with SSH

#104

Post by gergles »

hughes wrote: post #101

This question might be hilariously naive... but why don't web browsers make signed requests, just as web servers make signed responses? If I create an account on a website, then associate a public key with my account, shouldn't the browser be able to sign each request with my key? The website then wouldn't ever even have to deal with cookies or sessions as long as I was logged in to my browser. Or better yet, if my k…

https://pilif.github.io/2008/05/why-is-nobody-using-ssl-clie...

Re: Signing in to websites with SSH

#105

Post by nzealand »

patio11 wrote: post #88

It is actually pretty useful to require SSH as a two-factor authentication method for internal services, particularly extraordinarily sensitive internal services which you'll expose solely to technical employees. I use it for exactly one purpose: authorizing the "ghosting" of a customer account. ("Log in as this user.") Putting that behind SSH means that anyone authorizing a ghosting has both a blessed SSH key and th…

You use vanilla ssh to authorize the ghost of a customer account?

Re: Signing in to websites with SSH

#106

Post by scott_karana »

hughes wrote: post #101

This question might be hilariously naive... but why don't web browsers make signed requests, just as web servers make signed responses? If I create an account on a website, then associate a public key with my account, shouldn't the browser be able to sign each request with my key? The website then wouldn't ever even have to deal with cookies or sessions as long as I was logged in to my browser. Or better yet, if my k…

This idea is exactly what I've always wanted, too. As others point out, it would definitely have to be opt-in, or it would be a great way to track.

(It would be nice to have ephemeral keys per-site, too, a la Bitcoin: why have a publically unified identity?)

Re: Signing in to websites with SSH

#107

Post by vertex-four »

hughes wrote: post #101

This question might be hilariously naive... but why don't web browsers make signed requests, just as web servers make signed responses? If I create an account on a website, then associate a public key with my account, shouldn't the browser be able to sign each request with my key? The website then wouldn't ever even have to deal with cookies or sessions as long as I was logged in to my browser. Or better yet, if my k…

> but why don't web browsers make signed requests, just as web servers make signed responses?

They can. The WebID people at the W3C are trying to make a standard out of this, that would allow for federated authentication in which you can securely share data with websites you visit. (They're not getting terribly far - huge portions of the stack are missing around the subject of "tell a server you own that another server can access , where the other server is identified using a WebID".)

The downsides? Basically, the UI sucks and is inconsistent between browsers, up to and including failing to let you log out or have multiple accounts on a website.

Re: Signing in to websites with SSH

#108

Post by Rafert »

chubot wrote: post #100
adamtj wrote: post #73

I love SSH, but I don't want to actually use SSH for this. That's not the important part. All I want is key-based authentication, and that doesn't need SSH. I want to be able to plug a security token into a USB port and be logged in, without even having to click a sign-in button. Reformat, reinstall, reboot, plug in security token, launch browser, type news.ycombinator.com and I'm already logged in.

You can do this with google products: https://support.google.com/accounts/answer/6103523?hl=en You just have to touch the USB security token to have it release the key. I believe the idea is that malware can't really trick you into touching it, so it's more secure.

It's works a bit different than 'releasing a key': http://fidoalliance.org/specs/fido-u2f-v1.0-ps-20141009/fido...

Re: Signing in to websites with SSH

#109

Post by jamiesonbecker »

ams6110 wrote: post #15

I've worked in support of computing clusters that are widely used by researchers. By far the most common problem people had with using these systems was grokking ssh keys. Masters and PhD Computer Science people are routinely baffled by them, provide their private keys instead of their public keys, or provide both, etc. People in general just don't get public/private key pairs. Any solution that requires any awarenes…

I've seen this too. I've literally had (otherwise very smart!) people email me their PPK files (Putty Private Keys)! (Userify does help a lot with this now, however.)

Re: Signing in to websites with SSH

#110

Post by duncankl »

fideloper wrote: post #41

Adding "-vvv" to the given SSH command, it looks like it uses the first SSH key given. I happen to have quite a few for various services. I suppose you could offer up one specifically by running ssh -o "IdentitiesOnly yes" -i ~/.ssh/id_whatever mars.vtllf.org (I use the IdentitiesOnly option because I often see ssh still offer other keys without it)

Thank you! I was looking for that option while writing the section on throwaway keys. I'll have to test it out.
Post reply on HN